Section 3999.217 - Authorization for Release of Information(a) Patients may authorize the release of their health care information by completing the CDCR 7385, Authorization for Release of Protected Health Information, to allow a family member or friend to request and receive an update when there is a significant change in the patient's health care condition. A CDCR 7385 and instructions can be obtained in the medical clinics and in health care settings. A CDCR 7385 will remain in force until its expiration date or until it is updated, changed, or revoked by written request of the patient at any time.(b) A patient's (or their personal representative's) authorization is considered valid if it contains at least the following elements: (1) A description of the information to be used or disclosed that identifies the information in specific terms.(2) The name or other specific identification of the persons(s) authorized to make the requested use or disclosure.(3) The name or other specific identification of the person(s) to whom the California Department of Corrections and Rehabilitation (CDCR) may make the requested use or disclosure.(4) A description of each purpose of the requested use or disclosure and the specific uses and limitations on the use of the health information by the persons or entities authorized to receive it. The statement "at the request of the individual" is a sufficient description of the purpose when a patient initiates the authorization and does not, or elects not to, provide a statement of the purpose.(5) An expiration date or an expiration event (e.g., conclusion of litigation, completion of surgery) that relates to the patient or the purpose of the use or disclosure after which disclosure is no longer authorized.(6) A signature which serves no other purpose than to execute the document and date. If the authorization is signed by a personal representative of the patient, a description of such representative's authority to act for the patient must also be provided.(7) A statement that the patient has the right to revoke the authorization in writing and a description of how the individual may revoke the authorization.(8) A statement that CDCR may not condition treatment on whether the patient signs the authorization.(9) A statement concerning the potential for the information disclosed to be subject to re-disclosure by the recipient and no longer protected by federal or state law.(10) A statement advising the patient of their right to receive a copy of the authorization.(11) The authorization is in writing in at least 14 point type and clearly separate from any other language present in the same document.(c) Other Release of Information authorization forms may be accepted if they conform to all of the requirements as specified in subsection (b).(d) An authorization is considered defective and invalid if any material information in the authorization is known to be false by CDCR, or if any of the following defects exist: (1) The expiration date or expiration event has passed.(2) The authorization has not been filled out completely or lacks a required element as specified in subsection (b).(3) The authorization is known to have been revoked. (A) A patient may revoke an authorization at any time in writing. No such revocation shall apply to information already released while the authorization was valid and in effect. 1. Exception: Alcohol and drug treatment participants may verbally revoke authorization to disclose information obtained from alcohol and drug treatment programs. Verbal authorizations and revocations must be documented and maintained in the patient's health record.(e) Special authorization is required for Human Immunodeficiency Virus (HIV) test results. A valid written authorization to disclose HIV test results shall be obtained before making such a disclosure. Written authorization is required for each separate disclosure of the test results. A general authorization by a patient to release medical information is not sufficient to release HIV test results; the authorization form must specifically indicate that HIV test results may be released. (1) HIV test results may be disclosed to the following persons without written authorization: (A) The patient's legal representative, or to any person authorized to consent to the test.(B) The patient's health care provider.(C) The Warden or designee pursuant to California Health & Safety Code section 121070.(D) As otherwise permitted or required by law; for example, to certain individuals as a result of occupational exposure. Legal counsel shall be consulted related to such disclosures.(f) Information about a patient may not be disclosed pursuant to a written authorization without verifying the identity of the person receiving the information.(g) A CDCR 7385 from the patient, a court order, or a search warrant specifically requesting the information is required for disclosure of:(2) Substance abuse or alcohol treatment records.(3) Substance abuse treatment program records provided by a contracted service.(5) Communicable diseases.(6) Mental health records.(A) If the patient's written request is to review their mental health records, authorization of the Chief of Mental Health or attending mental health clinician shall be obtained.(B) The Chief of Mental Health or attending mental health clinician may deny a request to review mental health records if there is a substantial risk of significant adverse or detrimental consequences to the patient in seeing or receiving a copy of the mental health records requested by the patient.(C) If the provider grants access to the mental health records in whole or in part, the patient shall be notified of the acceptance of the request and provided the records within 15 calendar days.(D) If the provider denies access to the mental health record, the patient shall be informed of the denial within 30 calendar days and will only be denied access to the information for which the provider has a basis to deny access. The denial must contain: 1. The basis of the denial.2. A description of how the patient may submit a complaint.(E) Health Records staff shall obtain a written statement from the attending clinician to be added to the patient's health record explaining the reason for denial. The statement shall:1. Explain why access to this information is harmful to the patient or to the patient-therapist relationship.2. State how access is to be granted, e.g., to a licensed mental health clinician or to a social worker selected by the patient.(F) Health care staff shall notify the patient that access will be granted to a licensed mental health clinician or to a social worker of their choice.(G) The patient shall notify Health Records staff of the appropriate person to access their information. 1. If the request is for records that are needed to support an appeal regarding eligibility for a public benefit program (e.g., Medi-Cal program, Social Security Disability Insurance benefits, or Supplemental Security Income/State Supplementary Program for the Aged, Blind and Disabled benefits), the following applies: a. The patient or patient's representative shall be entitled to one copy, at no charge, of the relevant portion of the patient's records, upon presenting to the health care provider a written request, and proof that the records are needed to support an appeal. These copies shall be transmitted within 30 calendar days after receiving the written request.b. This process shall not apply to any patient who is represented by a private attorney who is paying for the costs related to the patient's appeal pending the outcome of that appeal.Cal. Code Regs. Tit. 15, § 3999.217
1. New section filed 7-1-2019 as an emergency; operative 7-1-2019 (Register 2019, No. 27). Pursuant to Penal Code section 5058.3, a Certificate of Compliance must be transmitted to OAL by 12-9-2019 or emergency language will be repealed by operation of law on the following day.
2. New section refiled 12-5-2019 as an emergency; operative 12-10-2019 (Register 2019, No. 49). Pursuant to Penal Code section 5058.3, a Certificate of Compliance must be transmitted to OAL by 3-9-2020 or emergency language will be repealed by operation of law on the following day.
3. New section refiled 3-9-2020 as an emergency; operative 3-10-2020 (Register 2020, No. 11). A Certificate of Compliance must be transmitted to OAL by 6-8-2020 or emergency language will be repealed by operation of law on the following day.
4. Certificate of Compliance as to 3-9-2020 order transmitted to OAL 6-8-2020 and filed 7-20-2020 (Register 2020, No. 30). Note: Authority cited: Section 5058, Penal Code. Reference: Section 5054, Penal Code; Plata v. Newsom (No. C01-1351 JST), U.S. District Court, Northern District of California; Clark v. California (No. C96-1486 CRB), U.S. District Court, Northern District of California; and Armstrong v. Newsom (No. C94-2307 CW), U.S. District Court, Northern District of California.
1. New section filed 7-1-2019 as an emergency; operative 7/1/2019 (Register 2019, No. 27). Pursuant to Penal Code section 5058.3, a Certificate of Compliance must be transmitted to OAL by 12-9-2019 or emergency language will be repealed by operation of law on the following day.
2. New section refiled 12-5-2019 as an emergency; operative 12/10/2019 (Register 2019, No. 49). Pursuant to Penal Code section 5058.3, a Certificate of Compliance must be transmitted to OAL by 3-9-2020 or emergency language will be repealed by operation of law on the following day.
3. New section refiled 3-9-2020 as an emergency; operative 3/10/2020 (Register 2020, No. 11). A Certificate of Compliance must be transmitted to OAL by 6-8-2020 or emergency language will be repealed by operation of law on the following day.
4. Certificate of Compliance as to 3-9-2020 order transmitted to OAL 6-8-2020 and filed 7/20/2020 (Register 2020, No. 30).